The Register® — Biting the hand that feeds IT

Feeds

Symantec ‘security scan’ distributes rootkit

Irony among the paranoiacs

  • print
  • alert

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

"Symantec Security Check is a free web-based tool that enables users to test their computer's exposure to a wide range of on-line threats," the press release begins. Unfortunately, Symantec Security Check has also been installing an on-line threat of its own in the form of a dangerous ActiveX control.

"The ActiveX control, named Symantec RuFSI Utility Class or Symantec RuFSI Registry Information Class, contains a buffer overflow exploit," the company says, though we're nearly certain they mean that it's exploitable, not that it's actually been infected with something. But you never know; the press release is one of those waffly ones that doesn't quite tell you everything you want to hear.

The buffer overflow can be exploited by hip Webmasters, and victims turning up at their sites risk having malicious code run on their Windows boxes.

The easiest way to get rid of the dangerous ActiveX control that security experts Symantec have planted on your machine is to visit the Security Check Web page again, submit to the security check once more, and allow them to install a much better one in its place, which they are now prepared to do.

Or, if you've had enough of their security expertise for now, you can, in Symantec's words, "attempt to remove" the relevant file thus:

Boot to a DOS prompt and delete the file rufsi.dll from the %Windir%\Downloaded Program Files\ directory.

Choose your poison. ®

Agentless Backup is Not a Myth

More from The Register

 breaking news
NSA PRISM snoop-gate: Won't someone think of the children, wails Apple
10,000 things probed, mostly about missing kids, Alzheimer patients, we're told
 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights
Speech-to-text drives motorists to distraction
Will talking to you mean I crash into that car up ahead, Siri?
DHS warns of vulns in hospital medical equipment
Has your doctor's anasthesia machine been hacked?
 breaking news
'BadNews is malware' says outfit that found it
Google says code harmless but Lookout says code base is evolving
Panda-peddlers cuffed for chess gambling gambit
More porridge on the menu for Chinese coders after second offence
 breaking news
Yes, maybe we should keep hackers in the clink for YEARS, mulls EU
Watch out black hats, they just might throw away the key
Internet fraud still stings suckers
Australians twice as gullible as Americans